Pin pixi version in images/Dockerfile

Open Beginner friendly
#243 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
1-3 hours
Newbie friendliness
88/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
dockerfile
Domain
build-system, devops

Research direction

Open images/Dockerfile and inspect the existing pixi installer invocation and image build context. Add a PIXI_VERSION build argument with a deliberate pinned value, then build the image and verify that repeated builds use the same pixi version and continue to honor the lockfile.

Written by the indexing model from the issue text.

Description

images/Dockerfile installs pixi unpinned:

RUN curl -fsSL https://pixi.sh/install.sh | PIXI_HOME=/usr/local bash

PIXI_VERSION appears nowhere in the repo, so every image build takes whatever pixi latest is that day. Not a security issue (pixi install --locked verifies the lock's PyPI sha256 on both cold and warm cache paths), but a pixi minor bump can change lock handling or resolution behavior with no corresponding change in this repo, making builds non-reproducible and failures hard to bisect.

Fix: pass a pinned version to the installer (PIXI_VERSION=vX.Y.Z) via an ARG, and bump it deliberately.

Raised in review of https://github.com/nebari-dev/data-science-pack/pull/241#pullrequestreview-5054401295.

Dominant language
Python
Stars
5
Forks
7
Avg merge
1d 20h
Merged PRs (30d)
13

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nebari-dev/data-science-pack

All issues in nebari-dev/data-science-pack

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.